Security Assertion Markup Language
SAML: XML-based federated identity standard enabling single sign-on; exploited via CitrixBleed 3's memory overread in the NetScaler SAML IdP path.
Last refreshed: 17 April 2026
Why does a bug in the Citrix SAML login page give hackers access to every company application?
Timeline for Security Assertion Markup Language
Mentioned in: CitrixBleed 3 lands on SAML broker
Cybersecurity: Threats and Defences- What is SAML and how was it exploited in CitrixBleed 3?
- SAML (Security Assertion Markup Language) is the enterprise single sign-on protocol. CitrixBleed 3 (CVE-2026-3055) exploits a memory overread in Citrix NetScaler's SAML Identity Provider path, leaking session tokens that allow attackers to bypass authentication for SAML-protected applications.Source: Citrix / CISA / Mandiant
Background
Security Assertion Markup Language (SAML) is the XML-based federation protocol used by NetScaler and other enterprise gateways to provide single sign-on across applications. CitrixBleed 3 (CVE-2026-3055) specifically targets the NetScaler SAML Identity Provider path: a crafted SAMLRequest to `/saml/login` that omits the AssertionConsumerServiceURL field causes the appliance to leak memory via the `NSC_TASS` cookie. Exploiting the leak gives attackers SAML session tokens, allowing them to bypass authentication entirely for any application protected by the compromised SAML broker.
SAML 2.0, standardised in 2005, remains the dominant federation protocol in enterprise environments, particularly for on-premises and hybrid deployments where newer OAuth/OIDC-based federation is not yet deployed. NetScaler's position as a SAML IdP in many large enterprises means that a memory-disclosure vulnerability in the SAML endpoint can provide authenticated access to hundreds of downstream applications from a single exploit.
For enterprise architects evaluating identity infrastructure, the CitrixBleed series (three critical memory CVEs in 30 months) in the NetScaler SAML path is the practical argument for migrating SAML brokerage off NetScaler to Cloud-native IdP services where the SAML processing occurs inside the IdP vendor's managed infrastructure rather than a customer-operated appliance. The migration cost is high; so is the serial-CVE lottery.